https://bugzilla.redhat.com/show_bug.cgi?id=1162666
Bug ID: 1162666 Summary: binutils: out of bounds memory write Product: Security Response Component: vulnerability Keywords: Security Severity: low Priority: low Assignee: security-response-team@redhat.com Reporter: vkaigoro@redhat.com CC: bgollahe@redhat.com, dan@danny.cz, dhowells@redhat.com, erik-fedora@vanpienbroek.nl, fedora-mingw@lists.fedoraproject.org, jakub@redhat.com, kalevlember@gmail.com, kanderso@redhat.com, ktietz@redhat.com, law@redhat.com, lkocman@redhat.com, lkundrak@v3.sk, mfranc@redhat.com, mhlavink@redhat.com, nickc@redhat.com, ohudlick@redhat.com, pfrankli@redhat.com, rjones@redhat.com, rob@robspanton.com, seceng-idm-qe-list@redhat.com, swhiteho@redhat.com, thibault.north@gmail.com, tmlcoch@redhat.com, trond.danielsen@gmail.com
It was reported [1] that objdump will try to overwrite part of memory when processing a crafted "ar" archive file. Upstream patch for this is at [2].
[1]: https://sourceware.org/bugzilla/show_bug.cgi?id=17533 [2]: https://sourceware.org/git/gitweb.cgi?p=binutils-gdb.git;h=bb0d867169d7e9743...
https://bugzilla.redhat.com/show_bug.cgi?id=1162666
Vasyl Kaigorodov vkaigoro@redhat.com changed:
What |Removed |Added ---------------------------------------------------------------------------- Blocks| |1156276
https://bugzilla.redhat.com/show_bug.cgi?id=1162666
Vasyl Kaigorodov vkaigoro@redhat.com changed:
What |Removed |Added ---------------------------------------------------------------------------- Depends On| |1162669 Depends On| |1162670 Depends On| |1162671 Depends On| |1162672 Depends On| |1162673 Depends On| |1162674 Depends On| |1162675 Depends On| |1162676 Depends On| |1162678
--- Comment #1 from Vasyl Kaigorodov vkaigoro@redhat.com ---
Created mingw-binutils tracking bugs for this issue:
Affects: fedora-all [bug 1162673] Affects: epel-all [bug 1162678]
Referenced Bugs:
https://bugzilla.redhat.com/show_bug.cgi?id=1162669 [Bug 1162669] arm-none-eabi-binutils-cs: binutils: out of bounds memory write [fedora-all] https://bugzilla.redhat.com/show_bug.cgi?id=1162670 [Bug 1162670] avr-binutils: binutils: out of bounds memory write [fedora-all] https://bugzilla.redhat.com/show_bug.cgi?id=1162671 [Bug 1162671] binutils: out of bounds memory write [fedora-all] https://bugzilla.redhat.com/show_bug.cgi?id=1162672 [Bug 1162672] cross-binutils: binutils: out of bounds memory write [fedora-all] https://bugzilla.redhat.com/show_bug.cgi?id=1162673 [Bug 1162673] mingw-binutils: binutils: out of bounds memory write [fedora-all] https://bugzilla.redhat.com/show_bug.cgi?id=1162674 [Bug 1162674] msp430-binutils: binutils: out of bounds memory write [fedora-all] https://bugzilla.redhat.com/show_bug.cgi?id=1162675 [Bug 1162675] avr-binutils: binutils: out of bounds memory write [epel-all] https://bugzilla.redhat.com/show_bug.cgi?id=1162676 [Bug 1162676] cross-binutils: binutils: out of bounds memory write [epel-all] https://bugzilla.redhat.com/show_bug.cgi?id=1162678 [Bug 1162678] mingw-binutils: binutils: out of bounds memory write [epel-all]
https://bugzilla.redhat.com/show_bug.cgi?id=1162666
--- Comment #2 from Vasyl Kaigorodov vkaigoro@redhat.com ---
Created avr-binutils tracking bugs for this issue:
Affects: fedora-all [bug 1162670] Affects: epel-all [bug 1162675]
https://bugzilla.redhat.com/show_bug.cgi?id=1162666
--- Comment #3 from Vasyl Kaigorodov vkaigoro@redhat.com ---
Created arm-none-eabi-binutils-cs tracking bugs for this issue:
Affects: fedora-all [bug 1162669]
https://bugzilla.redhat.com/show_bug.cgi?id=1162666
--- Comment #4 from Vasyl Kaigorodov vkaigoro@redhat.com ---
Created msp430-binutils tracking bugs for this issue:
Affects: fedora-all [bug 1162674]
https://bugzilla.redhat.com/show_bug.cgi?id=1162666
--- Comment #5 from Vasyl Kaigorodov vkaigoro@redhat.com ---
Created cross-binutils tracking bugs for this issue:
Affects: fedora-all [bug 1162672] Affects: epel-all [bug 1162676]
https://bugzilla.redhat.com/show_bug.cgi?id=1162666
--- Comment #6 from Vasyl Kaigorodov vkaigoro@redhat.com ---
Created binutils tracking bugs for this issue:
Affects: fedora-all [bug 1162671]
https://bugzilla.redhat.com/show_bug.cgi?id=1162666
--- Comment #7 from Nick Clifton nickc@redhat.com --- Created attachment 957153 --> https://bugzilla.redhat.com/attachment.cgi?id=957153&action=edit Imported for for PR 17533
https://bugzilla.redhat.com/show_bug.cgi?id=1162666
Nick Clifton nickc@redhat.com changed:
What |Removed |Added ---------------------------------------------------------------------------- Status|NEW |ASSIGNED
--- Comment #8 from Nick Clifton nickc@redhat.com --- Fixed in: binutils-2.24-29.fc22
I have applied a patch (uploaded to this BZ) to the rawhide binutils. It is derived from the patches created for PR 17533, adapted to work with the rawhide sources.
Ideally the patch will soon be redundant, as rawhide should be switching over to the 2.25 binutils release, once that actually happens. 2.25 already contains this patch.
https://bugzilla.redhat.com/show_bug.cgi?id=1162666
Martin Prpic mprpic@redhat.com changed:
What |Removed |Added ---------------------------------------------------------------------------- Alias| |CVE-2014-8738
https://bugzilla.redhat.com/show_bug.cgi?id=1162666
Martin Prpic mprpic@redhat.com changed:
What |Removed |Added ---------------------------------------------------------------------------- Summary|binutils: out of bounds |CVE-2014-8738 binutils: out |memory write |of bounds memory write
https://bugzilla.redhat.com/show_bug.cgi?id=1162666
Vasyl Kaigorodov vkaigoro@redhat.com changed:
What |Removed |Added ---------------------------------------------------------------------------- Fixed In Version| |binutils 2.25
https://bugzilla.redhat.com/show_bug.cgi?id=1162666
Vasyl Kaigorodov vkaigoro@redhat.com changed:
What |Removed |Added ---------------------------------------------------------------------------- Whiteboard|impact=low,public=20141102, |impact=low,public=20141102, |reported=20141111,source=os |reported=20141111,source=os |s-sec,cvss2=1.2/AV:L/AC:H/A |s-sec,cvss2=1.2/AV:L/AC:H/A |u:N/C:P/I:N/A:N,dts-2.1/dev |u:N/C:P/I:N/A:N,dts-2.1/dev |toolset-2-binutils=new,dts- |toolset-2-binutils=affected |3.0/devtoolset-3-binutils=n |,dts-3.0/devtoolset-3-binut |ew,fedora-all/arm-none-eabi |ils=affected,fedora-all/arm |-binutils-cs=affected,fedor |-none-eabi-binutils-cs=affe |a-all/avr-binutils=affected |cted,fedora-all/avr-binutil |,fedora-all/binutils=affect |s=affected,fedora-all/binut |ed,fedora-all/cross-binutil |ils=affected,fedora-all/cro |s=affected,fedora-all/mingw |ss-binutils=affected,fedora |-binutils=affected,fedora-a |-all/mingw-binutils=affecte |ll/msp430-binutils=affected |d,fedora-all/msp430-binutil |,rhel-4/binutils=new,rhel-5 |s=affected,rhel-4/binutils= |/binutils=new,rhel-5/binuti |new,rhel-5/binutils=wontfix |ls220=new,rhel-6/binutils=n |,rhel-5/binutils220=wontfix |ew,rhel-6/mingw32-binutils= |,rhel-6/binutils=affected,r |new,rhel-7/binutils=new,epe |hel-6/mingw32-binutils=defe |l-all/avr-binutils=affected |r,rhel-7/binutils=affected, |,epel-all/cross-binutils=af |epel-all/avr-binutils=affec |fected,epel-all/mingw-binut |ted,epel-all/cross-binutils |ils=affected |=affected,epel-all/mingw-bi | |nutils=affected
--- Comment #9 from Vasyl Kaigorodov vkaigoro@redhat.com --- Statement:
Red Hat Enterprise Linux 5 is now in Production 3 Phase of the support and maintenance life cycle. This has been rated as having Low security impact and is not currently planned to be addressed in future updates. For additional information, refer to the Red Hat Enterprise Linux Life Cycle: https://access.redhat.com/support/policy/updates/errata/.
https://bugzilla.redhat.com/show_bug.cgi?id=1162666
Vasyl Kaigorodov vkaigoro@redhat.com changed:
What |Removed |Added ---------------------------------------------------------------------------- Whiteboard|impact=low,public=20141102, |impact=low,public=20141102, |reported=20141111,source=os |reported=20141111,source=os |s-sec,cvss2=1.2/AV:L/AC:H/A |s-sec,cvss2=1.2/AV:L/AC:H/A |u:N/C:P/I:N/A:N,dts-2.1/dev |u:N/C:P/I:N/A:N,dts-2.1/dev |toolset-2-binutils=affected |toolset-2-binutils=affected |,dts-3.0/devtoolset-3-binut |,dts-3.0/devtoolset-3-binut |ils=affected,fedora-all/arm |ils=affected,fedora-all/arm |-none-eabi-binutils-cs=affe |-none-eabi-binutils-cs=affe |cted,fedora-all/avr-binutil |cted,fedora-all/avr-binutil |s=affected,fedora-all/binut |s=affected,fedora-all/binut |ils=affected,fedora-all/cro |ils=affected,fedora-all/cro |ss-binutils=affected,fedora |ss-binutils=affected,fedora |-all/mingw-binutils=affecte |-all/mingw-binutils=affecte |d,fedora-all/msp430-binutil |d,fedora-all/msp430-binutil |s=affected,rhel-4/binutils= |s=affected,rhel-5/binutils= |new,rhel-5/binutils=wontfix |wontfix,rhel-5/binutils220= |,rhel-5/binutils220=wontfix |wontfix,rhel-6/binutils=aff |,rhel-6/binutils=affected,r |ected,rhel-6/mingw32-binuti |hel-6/mingw32-binutils=defe |ls=defer,rhel-7/binutils=af |r,rhel-7/binutils=affected, |fected,epel-all/avr-binutil |epel-all/avr-binutils=affec |s=affected,epel-all/cross-b |ted,epel-all/cross-binutils |inutils=affected,epel-all/m |=affected,epel-all/mingw-bi |ingw-binutils=affected |nutils=affected |
https://bugzilla.redhat.com/show_bug.cgi?id=1162666
Vasyl Kaigorodov vkaigoro@redhat.com changed:
What |Removed |Added ---------------------------------------------------------------------------- Depends On| |1168281
https://bugzilla.redhat.com/show_bug.cgi?id=1162666
Vasyl Kaigorodov vkaigoro@redhat.com changed:
What |Removed |Added ---------------------------------------------------------------------------- Depends On| |1168302
https://bugzilla.redhat.com/show_bug.cgi?id=1162666
Tomas Hoger thoger@redhat.com changed:
What |Removed |Added ---------------------------------------------------------------------------- Whiteboard|impact=low,public=20141102, |impact=low,public=20141102, |reported=20141111,source=os |reported=20141111,source=os |s-sec,cvss2=1.2/AV:L/AC:H/A |s-sec,cvss2=1.2/AV:L/AC:H/A |u:N/C:P/I:N/A:N,dts-2.1/dev |u:N/C:P/I:N/A:N,dts-2.1/dev |toolset-2-binutils=affected |toolset-2-binutils=affected |,dts-3.0/devtoolset-3-binut |,dts-3.0/devtoolset-3-binut |ils=affected,fedora-all/arm |ils=affected,fedora-all/arm |-none-eabi-binutils-cs=affe |-none-eabi-binutils-cs=affe |cted,fedora-all/avr-binutil |cted,fedora-all/avr-binutil |s=affected,fedora-all/binut |s=affected,fedora-all/binut |ils=affected,fedora-all/cro |ils=affected,fedora-all/cro |ss-binutils=affected,fedora |ss-binutils=affected,fedora |-all/mingw-binutils=affecte |-all/mingw-binutils=affecte |d,fedora-all/msp430-binutil |d,fedora-all/msp430-binutil |s=affected,rhel-5/binutils= |s=affected,rhel-5/binutils= |wontfix,rhel-5/binutils220= |wontfix,rhel-5/binutils220= |wontfix,rhel-6/binutils=aff |wontfix,rhel-6/binutils=aff |ected,rhel-6/mingw32-binuti |ected,rhel-6/mingw32-binuti |ls=defer,rhel-7/binutils=af |ls=wontfix,rhel-7/binutils= |fected,epel-all/avr-binutil |affected,epel-all/avr-binut |s=affected,epel-all/cross-b |ils=affected,epel-all/cross |inutils=affected,epel-all/m |-binutils=affected,epel-all |ingw-binutils=affected |/mingw-binutils=affected
https://bugzilla.redhat.com/show_bug.cgi?id=1162666
Vasyl Kaigorodov vkaigoro@redhat.com changed:
What |Removed |Added ---------------------------------------------------------------------------- Whiteboard|impact=low,public=20141102, |impact=low,public=20141102, |reported=20141111,source=os |reported=20141111,source=os |s-sec,cvss2=1.2/AV:L/AC:H/A |s-sec,cvss2=1.2/AV:L/AC:H/A |u:N/C:P/I:N/A:N,dts-2.1/dev |u:N/C:P/I:N/A:N,dts-2.1/dev |toolset-2-binutils=affected |toolset-2-binutils=affected |,dts-3.0/devtoolset-3-binut |,dts-3.0/devtoolset-3-binut |ils=affected,fedora-all/arm |ils=affected,fedora-all/arm |-none-eabi-binutils-cs=affe |-none-eabi-binutils-cs=affe |cted,fedora-all/avr-binutil |cted,fedora-all/avr-binutil |s=affected,fedora-all/binut |s=affected,fedora-all/binut |ils=affected,fedora-all/cro |ils=affected,fedora-all/cro |ss-binutils=affected,fedora |ss-binutils=affected,fedora |-all/mingw-binutils=affecte |-all/mingw-binutils=affecte |d,fedora-all/msp430-binutil |d,fedora-all/msp430-binutil |s=affected,rhel-5/binutils= |s=affected,rhel-5/binutils= |wontfix,rhel-5/binutils220= |wontfix,rhel-5/binutils220= |wontfix,rhel-6/binutils=aff |wontfix,rhel-6/binutils=aff |ected,rhel-6/mingw32-binuti |ected,rhel-6/mingw32-binuti |ls=wontfix,rhel-7/binutils= |ls=wontfix,rhel-7/binutils= |affected,epel-all/avr-binut |defer,epel-all/avr-binutils |ils=affected,epel-all/cross |=affected,epel-all/cross-bi |-binutils=affected,epel-all |nutils=affected,epel-all/mi |/mingw-binutils=affected |ngw-binutils=affected
https://bugzilla.redhat.com/show_bug.cgi?id=1162666 Bug 1162666 depends on bug 1162669, which changed state.
Bug 1162669 Summary: arm-none-eabi-binutils-cs: binutils: out of bounds memory write [fedora-all] https://bugzilla.redhat.com/show_bug.cgi?id=1162669
What |Removed |Added ---------------------------------------------------------------------------- Status|ON_QA |CLOSED Resolution|--- |ERRATA
https://bugzilla.redhat.com/show_bug.cgi?id=1162666
--- Comment #11 from Fedora Update System updates@fedoraproject.org --- arm-none-eabi-binutils-cs-2014.05.28-3.fc20 has been pushed to the Fedora 20 stable repository. If problems still persist, please make note of it in this bug report.
https://bugzilla.redhat.com/show_bug.cgi?id=1162666 Bug 1162666 depends on bug 1162670, which changed state.
Bug 1162670 Summary: avr-binutils: binutils: out of bounds memory write [fedora-all] https://bugzilla.redhat.com/show_bug.cgi?id=1162670
What |Removed |Added ---------------------------------------------------------------------------- Status|ON_QA |CLOSED Resolution|--- |ERRATA
https://bugzilla.redhat.com/show_bug.cgi?id=1162666
--- Comment #12 from Fedora Update System updates@fedoraproject.org --- avr-binutils-2.24-3.fc20 has been pushed to the Fedora 20 stable repository. If problems still persist, please make note of it in this bug report.
https://bugzilla.redhat.com/show_bug.cgi?id=1162666
--- Comment #13 from Fedora Update System updates@fedoraproject.org --- avr-binutils-2.24-4.fc21 has been pushed to the Fedora 21 stable repository. If problems still persist, please make note of it in this bug report.
https://bugzilla.redhat.com/show_bug.cgi?id=1162666
--- Comment #14 from Fedora Update System updates@fedoraproject.org --- arm-none-eabi-binutils-cs-2014.05.28-3.fc21 has been pushed to the Fedora 21 stable repository. If problems still persist, please make note of it in this bug report.
https://bugzilla.redhat.com/show_bug.cgi?id=1162666
--- Comment #15 from Fedora Update System updates@fedoraproject.org --- avr-binutils-2.24-3.fc19 has been pushed to the Fedora 19 stable repository. If problems still persist, please make note of it in this bug report.
https://bugzilla.redhat.com/show_bug.cgi?id=1162666
--- Comment #16 from Fedora Update System updates@fedoraproject.org --- arm-none-eabi-binutils-cs-2014.05.28-3.fc19 has been pushed to the Fedora 19 stable repository. If problems still persist, please make note of it in this bug report.
https://bugzilla.redhat.com/show_bug.cgi?id=1162666
Vasyl Kaigorodov vkaigoro@redhat.com changed:
What |Removed |Added ---------------------------------------------------------------------------- Depends On| |1172710
https://bugzilla.redhat.com/show_bug.cgi?id=1162666 Bug 1162666 depends on bug 1162673, which changed state.
Bug 1162673 Summary: mingw-binutils: binutils: out of bounds memory write [fedora-all] https://bugzilla.redhat.com/show_bug.cgi?id=1162673
What |Removed |Added ---------------------------------------------------------------------------- Status|ON_QA |CLOSED Resolution|--- |ERRATA
https://bugzilla.redhat.com/show_bug.cgi?id=1162666 Bug 1162666 depends on bug 1162678, which changed state.
Bug 1162678 Summary: mingw-binutils: binutils: out of bounds memory write [epel-all] https://bugzilla.redhat.com/show_bug.cgi?id=1162678
What |Removed |Added ---------------------------------------------------------------------------- Status|MODIFIED |CLOSED Resolution|--- |ERRATA
https://bugzilla.redhat.com/show_bug.cgi?id=1162666
--- Comment #18 from Fedora Update System updates@fedoraproject.org --- binutils-2.24-30.fc21 has been pushed to the Fedora 21 stable repository. If problems still persist, please make note of it in this bug report.
https://bugzilla.redhat.com/show_bug.cgi?id=1162666 Bug 1162666 depends on bug 1162672, which changed state.
Bug 1162672 Summary: cross-binutils: binutils: out of bounds memory write [fedora-all] https://bugzilla.redhat.com/show_bug.cgi?id=1162672
What |Removed |Added ---------------------------------------------------------------------------- Status|MODIFIED |CLOSED Resolution|--- |CURRENTRELEASE
https://bugzilla.redhat.com/show_bug.cgi?id=1162666
--- Comment #19 from Vasyl Kaigorodov vkaigoro@redhat.com --- Reproducer is available in https://sourceware.org/bugzilla/show_bug.cgi?id=17533#c0
https://bugzilla.redhat.com/show_bug.cgi?id=1162666
Vasyl Kaigorodov vkaigoro@redhat.com changed:
What |Removed |Added ---------------------------------------------------------------------------- Whiteboard|impact=low,public=20141102, |impact=low,public=20141102, |reported=20141111,source=os |reported=20141111,source=os |s-sec,cvss2=1.2/AV:L/AC:H/A |s-security,cvss2=1.2/AV:L/A |u:N/C:P/I:N/A:N,dts-2.1/dev |C:H/Au:N/C:P/I:N/A:N,dts-2. |toolset-2-binutils=affected |1/devtoolset-2-binutils=aff |,dts-3.0/devtoolset-3-binut |ected,dts-3.0/devtoolset-3- |ils=affected,fedora-all/arm |binutils=affected,fedora-al |-none-eabi-binutils-cs=affe |l/arm-none-eabi-binutils-cs |cted,fedora-all/avr-binutil |=affected,fedora-all/avr-bi |s=affected,fedora-all/binut |nutils=affected,fedora-all/ |ils=affected,fedora-all/cro |binutils=affected,fedora-al |ss-binutils=affected,fedora |l/cross-binutils=affected,f |-all/mingw-binutils=affecte |edora-all/mingw-binutils=af |d,fedora-all/msp430-binutil |fected,fedora-all/msp430-bi |s=affected,rhel-5/binutils= |nutils=affected,rhel-5/binu |wontfix,rhel-5/binutils220= |tils=wontfix,rhel-5/binutil |wontfix,rhel-6/binutils=aff |s220=wontfix,rhel-6/binutil |ected,rhel-6/mingw32-binuti |s=affected,rhel-6/mingw32-b |ls=wontfix,rhel-7/binutils= |inutils=wontfix,rhel-7/binu |defer,epel-all/avr-binutils |tils=defer,epel-all/avr-bin |=affected,epel-all/cross-bi |utils=affected,epel-all/cro |nutils=affected,epel-all/mi |ss-binutils=affected,epel-a |ngw-binutils=affected |ll/mingw-binutils=affected
https://bugzilla.redhat.com/show_bug.cgi?id=1162666
Ján Rusnačko jrusnack@redhat.com changed:
What |Removed |Added ---------------------------------------------------------------------------- CC| |jrusnack@redhat.com Whiteboard|impact=low,public=20141102, |impact=low,public=20141102, |reported=20141111,source=os |reported=20141111,source=os |s-security,cvss2=1.2/AV:L/A |s-security,cvss2=1.2/AV:L/A |C:H/Au:N/C:P/I:N/A:N,dts-2. |C:H/Au:N/C:P/I:N/A:N,dts-2. |1/devtoolset-2-binutils=aff |1/devtoolset-2-binutils=aff |ected,dts-3.0/devtoolset-3- |ected,dts-3.0/devtoolset-3- |binutils=affected,fedora-al |binutils=affected,fedora-al |l/arm-none-eabi-binutils-cs |l/arm-none-eabi-binutils-cs |=affected,fedora-all/avr-bi |=affected,fedora-all/avr-bi |nutils=affected,fedora-all/ |nutils=affected,fedora-all/ |binutils=affected,fedora-al |binutils=affected,fedora-al |l/cross-binutils=affected,f |l/cross-binutils=affected,f |edora-all/mingw-binutils=af |edora-all/mingw-binutils=af |fected,fedora-all/msp430-bi |fected,fedora-all/msp430-bi |nutils=affected,rhel-5/binu |nutils=affected,rhel-5/binu |tils=wontfix,rhel-5/binutil |tils=wontfix,rhel-5/binutil |s220=wontfix,rhel-6/binutil |s220=wontfix,rhel-6/binutil |s=affected,rhel-6/mingw32-b |s=affected,rhel-6/mingw32-b |inutils=wontfix,rhel-7/binu |inutils=wontfix,rhel-7/binu |tils=defer,epel-all/avr-bin |tils=defer,epel-all/avr-bin |utils=affected,epel-all/cro |utils=affected,epel-all/cro |ss-binutils=affected,epel-a |ss-binutils=affected,epel-a |ll/mingw-binutils=affected |ll/mingw-binutils=affected, | |cwe=CWE-787
https://bugzilla.redhat.com/show_bug.cgi?id=1162666
Vasyl Kaigorodov vkaigoro@redhat.com changed:
What |Removed |Added ---------------------------------------------------------------------------- Whiteboard|impact=low,public=20141102, |impact=low,public=20141102, |reported=20141111,source=os |reported=20141111,source=os |s-security,cvss2=1.2/AV:L/A |s-security,cvss2=2.6/AV:L/A |C:H/Au:N/C:P/I:N/A:N,dts-2. |C:H/Au:N/C:P/I:N/A:P,dts-2. |1/devtoolset-2-binutils=aff |1/devtoolset-2-binutils=aff |ected,dts-3.0/devtoolset-3- |ected,dts-3.0/devtoolset-3- |binutils=affected,fedora-al |binutils=affected,fedora-al |l/arm-none-eabi-binutils-cs |l/arm-none-eabi-binutils-cs |=affected,fedora-all/avr-bi |=affected,fedora-all/avr-bi |nutils=affected,fedora-all/ |nutils=affected,fedora-all/ |binutils=affected,fedora-al |binutils=affected,fedora-al |l/cross-binutils=affected,f |l/cross-binutils=affected,f |edora-all/mingw-binutils=af |edora-all/mingw-binutils=af |fected,fedora-all/msp430-bi |fected,fedora-all/msp430-bi |nutils=affected,rhel-5/binu |nutils=affected,rhel-5/binu |tils=wontfix,rhel-5/binutil |tils=wontfix,rhel-5/binutil |s220=wontfix,rhel-6/binutil |s220=wontfix,rhel-6/binutil |s=affected,rhel-6/mingw32-b |s=affected,rhel-6/mingw32-b |inutils=wontfix,rhel-7/binu |inutils=wontfix,rhel-7/binu |tils=defer,epel-all/avr-bin |tils=defer,epel-all/avr-bin |utils=affected,epel-all/cro |utils=affected,epel-all/cro |ss-binutils=affected,epel-a |ss-binutils=affected,epel-a |ll/mingw-binutils=affected, |ll/mingw-binutils=affected, |cwe=CWE-787 |cwe=CWE-787
--- Doc Text *updated* --- A heap-based buffer overflow flaw was found in the way some binutils utilities were processing certain files. If a user were tricked into running an utility on a specially crafted file, it could cause such utility to crash or potentially execute arbitrary code with the privileges of the user running an executable.
https://bugzilla.redhat.com/show_bug.cgi?id=1162666
--- Doc Text *updated* by Martin Prpic mprpic@redhat.com --- A heap-based buffer overflow flaw was found in the way certain binutils utilities processed archive files. If a user were tricked into processing a specially crafted archive file, it could cause the utility used to process that archive to crash or, potentially, execute arbitrary code with the privileges of the user running that utility.
https://bugzilla.redhat.com/show_bug.cgi?id=1162666
Nick Clifton nickc@redhat.com changed:
What |Removed |Added ---------------------------------------------------------------------------- Status|ASSIGNED |MODIFIED Fixed In Version|binutils 2.25 |binutils-2.23.52.0.1-46.el7
https://bugzilla.redhat.com/show_bug.cgi?id=1162666
Nick Clifton nickc@redhat.com changed:
What |Removed |Added ---------------------------------------------------------------------------- Status|MODIFIED |NEW
https://bugzilla.redhat.com/show_bug.cgi?id=1162666
Nick Clifton nickc@redhat.com changed:
What |Removed |Added ---------------------------------------------------------------------------- Status|NEW |MODIFIED Fixed In Version|binutils-2.23.52.0.1-46.el7 |binutils-2.23.52.0.1-50.el7
https://bugzilla.redhat.com/show_bug.cgi?id=1162666 Bug 1162666 depends on bug 1162671, which changed state.
Bug 1162671 Summary: binutils: out of bounds memory write [fedora-all] https://bugzilla.redhat.com/show_bug.cgi?id=1162671
What |Removed |Added ---------------------------------------------------------------------------- Status|NEW |CLOSED Resolution|--- |EOL
https://bugzilla.redhat.com/show_bug.cgi?id=1162666 Bug 1162666 depends on bug 1162674, which changed state.
Bug 1162674 Summary: msp430-binutils: binutils: out of bounds memory write [fedora-all] https://bugzilla.redhat.com/show_bug.cgi?id=1162674
What |Removed |Added ---------------------------------------------------------------------------- Status|NEW |CLOSED Resolution|--- |EOL
https://bugzilla.redhat.com/show_bug.cgi?id=1162666
Tomas Hoger thoger@redhat.com changed:
What |Removed |Added ---------------------------------------------------------------------------- Status|MODIFIED |NEW Fixed In Version|binutils-2.23.52.0.1-50.el7 |binutils 2.25
https://bugzilla.redhat.com/show_bug.cgi?id=1162666
Miloš Prchlík mprchlik@redhat.com changed:
What |Removed |Added ---------------------------------------------------------------------------- CC| |mprchlik@redhat.com
https://bugzilla.redhat.com/show_bug.cgi?id=1162666
Huzaifa S. Sidhpurwala huzaifas@redhat.com changed:
What |Removed |Added ---------------------------------------------------------------------------- Blocks| |1210268
https://bugzilla.redhat.com/show_bug.cgi?id=1162666
Huzaifa S. Sidhpurwala huzaifas@redhat.com changed:
What |Removed |Added ---------------------------------------------------------------------------- Whiteboard|impact=low,public=20141102, |impact=low,public=20141102, |reported=20141111,source=os |reported=20141111,source=os |s-security,cvss2=2.6/AV:L/A |s-security,cvss2=2.6/AV:L/A |C:H/Au:N/C:P/I:N/A:P,dts-2. |C:H/Au:N/C:P/I:N/A:P,dts-2. |1/devtoolset-2-binutils=aff |1/devtoolset-2-binutils=aff |ected,dts-3.0/devtoolset-3- |ected,dts-3.0/devtoolset-3- |binutils=affected,fedora-al |binutils=affected,fedora-al |l/arm-none-eabi-binutils-cs |l/arm-none-eabi-binutils-cs |=affected,fedora-all/avr-bi |=affected,fedora-all/avr-bi |nutils=affected,fedora-all/ |nutils=affected,fedora-all/ |binutils=affected,fedora-al |binutils=affected,fedora-al |l/cross-binutils=affected,f |l/cross-binutils=affected,f |edora-all/mingw-binutils=af |edora-all/mingw-binutils=af |fected,fedora-all/msp430-bi |fected,fedora-all/msp430-bi |nutils=affected,rhel-5/binu |nutils=affected,rhel-5/binu |tils=wontfix,rhel-5/binutil |tils=wontfix,rhel-5/binutil |s220=wontfix,rhel-6/binutil |s220=wontfix,rhel-6/binutil |s=affected,rhel-6/mingw32-b |s=affected,rhel-6/mingw32-b |inutils=wontfix,rhel-7/binu |inutils=wontfix,rhel-7/binu |tils=defer,epel-all/avr-bin |tils=affected,epel-all/avr- |utils=affected,epel-all/cro |binutils=affected,epel-all/ |ss-binutils=affected,epel-a |cross-binutils=affected,epe |ll/mingw-binutils=affected, |l-all/mingw-binutils=affect |cwe=CWE-787 |ed,cwe=CWE-787
https://bugzilla.redhat.com/show_bug.cgi?id=1162666
Martin Prpic mprpic@redhat.com changed:
What |Removed |Added ---------------------------------------------------------------------------- Whiteboard|impact=low,public=20141102, |impact=low,public=20141102, |reported=20141111,source=os |reported=20141111,source=os |s-security,cvss2=2.6/AV:L/A |s-security,cvss2=2.6/AV:L/A |C:H/Au:N/C:P/I:N/A:P,dts-2. |C:H/Au:N/C:P/I:N/A:P,dts-2. |1/devtoolset-2-binutils=aff |1/devtoolset-2-binutils=won |ected,dts-3.0/devtoolset-3- |tfix,dts-3.0/devtoolset-3-b |binutils=affected,fedora-al |inutils=affected,fedora-all |l/arm-none-eabi-binutils-cs |/arm-none-eabi-binutils-cs= |=affected,fedora-all/avr-bi |affected,fedora-all/avr-bin |nutils=affected,fedora-all/ |utils=affected,fedora-all/b |binutils=affected,fedora-al |inutils=affected,fedora-all |l/cross-binutils=affected,f |/cross-binutils=affected,fe |edora-all/mingw-binutils=af |dora-all/mingw-binutils=aff |fected,fedora-all/msp430-bi |ected,fedora-all/msp430-bin |nutils=affected,rhel-5/binu |utils=affected,rhel-5/binut |tils=wontfix,rhel-5/binutil |ils=wontfix,rhel-5/binutils |s220=wontfix,rhel-6/binutil |220=wontfix,rhel-6/binutils |s=affected,rhel-6/mingw32-b |=affected,rhel-6/mingw32-bi |inutils=wontfix,rhel-7/binu |nutils=wontfix,rhel-7/binut |tils=affected,epel-all/avr- |ils=affected,epel-all/avr-b |binutils=affected,epel-all/ |inutils=affected,epel-all/c |cross-binutils=affected,epe |ross-binutils=affected,epel |l-all/mingw-binutils=affect |-all/mingw-binutils=affecte |ed,cwe=CWE-787 |d,cwe=CWE-787
https://bugzilla.redhat.com/show_bug.cgi?id=1162666
--- Comment #21 from Fedora Update System updates@fedoraproject.org --- cross-binutils-2.23.88.0.1-2.el7.1 has been pushed to the Fedora EPEL 7 stable repository. If problems still persist, please make note of it in this bug report.
https://bugzilla.redhat.com/show_bug.cgi?id=1162666 Bug 1162666 depends on bug 1162676, which changed state.
Bug 1162676 Summary: cross-binutils: binutils: out of bounds memory write [epel-all] https://bugzilla.redhat.com/show_bug.cgi?id=1162676
What |Removed |Added ---------------------------------------------------------------------------- Status|ON_QA |CLOSED Resolution|--- |ERRATA
https://bugzilla.redhat.com/show_bug.cgi?id=1162666
--- Comment #22 from Fedora Update System updates@fedoraproject.org --- cross-binutils-2.23.51.0.3-1.el6.1 has been pushed to the Fedora EPEL 6 stable repository. If problems still persist, please make note of it in this bug report.
https://bugzilla.redhat.com/show_bug.cgi?id=1162666
Nick Clifton nickc@redhat.com changed:
What |Removed |Added ---------------------------------------------------------------------------- Status|NEW |MODIFIED Fixed In Version|binutils 2.25 |binutils-2.23.52.0.1-55.el7
--- Comment #23 from Nick Clifton nickc@redhat.com --- I have checked in an updated patch for this issue. The previous version of the patch was missing a delta, which effectively made it useless. The new version is available in: binutils-2.23.52.0.1-55.el7
https://bugzilla.redhat.com/show_bug.cgi?id=1162666
Nick Clifton nickc@redhat.com changed:
What |Removed |Added ---------------------------------------------------------------------------- Status|MODIFIED |NEW
--- Comment #24 from Nick Clifton nickc@redhat.com --- oops - I should not have changed this BZ, sorry...
https://bugzilla.redhat.com/show_bug.cgi?id=1162666
--- Comment #25 from errata-xmlrpc errata-xmlrpc@redhat.com --- This issue has been addressed in the following products:
Red Hat Enterprise Linux 7
Via RHSA-2015:2079 https://rhn.redhat.com/errata/RHSA-2015-2079.html
-
Red Hat Bugzilla